Use new oidc authsch endpoint

README.md

@@ -130,6 +130,7 @@ spring.security.oauth2.client.registration.google.client-secret=<google client-s
 hu.bme.sch.cmsch.startup.sysadmins=<your pekId>
 cmsch.website-default-url=http://<your ip>:8080/
 hu.bme.sch.cmsch.login.googleAdminAddresses=<your email address>
+hu.bme.sch.cmsch.login.authschAdminAddresses=<your sAMAccountName>@sch.bme.hu
 logging.level.web=DEBUG
 ```
 

backend/src/main/kotlin/hu/bme/sch/cmsch/component/admission/AdmissionService.kt

@@ -107,9 +107,12 @@ class AdmissionService(
             return ticketRepository.findTop1ByQrCodeAndUseCmschIdTrue(cmschId).firstOrNull()
 
         } else {
-            val ticketByEmail = ticketRepository.findTop1ByEmailAndUseCmschIdFalse(user.email).firstOrNull()
-            if (user.email.isNotEmpty() && ticketByEmail != null) {
-                return ticketByEmail
+            val email = user.email
+            if (!email.isNullOrEmpty()) {
+                val ticketByEmail = ticketRepository.findTop1ByEmailAndUseCmschIdFalse(email).firstOrNull()
+                if (ticketByEmail != null) {
+                    return ticketByEmail
+                }
             }
 
             return ticketRepository.findTop1ByQrCodeAndUseCmschIdTrue(cmschId).firstOrNull()

backend/src/main/kotlin/hu/bme/sch/cmsch/component/challenge/ChallengeController.kt

@@ -142,4 +142,4 @@ class ChallengeController(
 }
 
 private fun mapUsername(it: UserEntity) =
-    "${it.fullNameWithAlias} | ${it.id} | [${it.provider.firstOrNull() ?: 'n'}] ${it.email}"
+    "${it.fullNameWithAlias} | ${it.id} | [${it.provider.firstOrNull() ?: 'n'}] ${it.email ?: ""}"

backend/src/main/kotlin/hu/bme/sch/cmsch/component/form/FormService.kt

@@ -426,7 +426,7 @@ class FormService(
             val email = submission[form.emailFieldName]
             if (!email.isNullOrBlank()) return email
         }
-        return user?.email
+        return user?.deliveryEmail
     }
 
     @Transactional(readOnly = true)

backend/src/main/kotlin/hu/bme/sch/cmsch/component/login/CmschUserDetailsService.kt

@@ -22,7 +22,7 @@ class CmschUserDetails(
 
     override fun getPassword(): String? = userEntity.password
 
-    override fun getUsername(): String = userEntity.email
+    override fun getUsername(): String = userEntity.email ?: userEntity.internalId
 
     override fun isAccountNonExpired(): Boolean = true
 
@@ -48,6 +48,7 @@ class CmschUserDetailsService(
     @Transactional(readOnly = true, isolation = Isolation.READ_COMMITTED)
     override fun loadUserByUsername(username: String): UserDetails {
         val user = userRepository.findByEmailIgnoreCase(username)
+            .or { userRepository.findByInternalId(username) }
             .orElseThrow { UsernameNotFoundException("User not found with email: $username") }
         return CmschUserDetails(user, loginComponent)
     }

backend/src/main/kotlin/hu/bme/sch/cmsch/component/login/LoginComponent.kt

@@ -40,28 +40,17 @@ class LoginComponent(
     val authschGroup by SettingGroup(fieldName = "AuthSCH",
         description = "Csak akkor írd át ha tudod mit csinálsz! Ha elrontod nem fog beengedni, szóval óvatosan!")
 
-    var authschScopesRaw by StringSettingRef(
-        listOf(Scope.BASIC, Scope.SURNAME, Scope.GIVEN_NAME, Scope.EDU_PERSON_ENTILEMENT, Scope.MAIL).joinToString(","),
+    var authschScopes by StringSettingRef(
+        listOf(Scope.OPEN_ID, Scope.PROFILE, Scope.EMAIL, Scope.SAM_ACCOUNT_NAME, Scope.BME_UNIT_SCOPE, Scope.PEK_PROFILE).joinToString(","),
         serverSideOnly = true, fieldName = "Oauth scopeok",
         description = "Ezek lesznek elkérve a providertől; ezek vannak: " + Scope.entries.joinToString(", ") { it.name })
 
-    val authschScopes = mutableListOf<Scope>()
-
-    override fun onInit() {
-        onPersist()
-    }
-
-    override fun onPersist() {
-        authschScopes.clear()
-        val scopes = authschScopesRaw.replace(" ", "").split(",")
+    fun getAuthschScopes(): Set<String> {
+        val scopes = authschScopes.split(",")
             .filter { it.isNotBlank() }
-            .mapNotNull { Scope.byNameOrNull(it) }
+            .mapNotNull { Scope.byNameOrNull(it.trim())?.scope }
             .distinct()
-        authschScopes.addAll(scopes)
-        authschScopesRaw = scopes.joinToString(",") { it.name }
-        log.info("Authsch scopes changed to '{}' and saved to the db as: '{}'",
-            authschScopes.map { it.name },
-            authschScopesRaw)
+        return setOf(*scopes.toTypedArray(), Scope.OPEN_ID.scope)
     }
 
     var onlyBmeProvider by BooleanSettingRef(false, serverSideOnly = false,
@@ -73,6 +62,10 @@ class LoginComponent(
     var authschPromotedFrontend by BooleanSettingRef(true, fieldName = "Authsch opció látszik (frontend)",
         description = "Ha ez be van kapcsolva, akkor a felhasználói felület /login oldalán látszik az AuthSCH SSO")
 
+    var authschAdminAddresses by StringSettingRef(serverSideOnly = true, fieldName = "ADMIN jogú emailcímek",
+        description = "Csak AuthSCH esetén! Ezeknek a felhasználóknak ADMIN joga lesz belépésnél. " +
+                "A sch-acc@sch.bme.hu emailcímek vesszővel felsorolva.")
+
     /// -------------------------------------------------------------------------------------------------------------------
 
     val ssoSecurityGroup by SettingGroup(fieldName = "SSO biztonság",

backend/src/main/kotlin/hu/bme/sch/cmsch/component/login/LoginService.kt

@@ -1,6 +1,6 @@
 package hu.bme.sch.cmsch.component.login
 
-import hu.bme.sch.cmsch.component.login.authsch.ProfileResponse
+import hu.bme.sch.cmsch.component.login.authsch.AuthschProfile
 import hu.bme.sch.cmsch.component.login.google.GoogleUserInfoResponse
 import hu.bme.sch.cmsch.component.login.keycloak.KeycloakUserInfoResponse
 import hu.bme.sch.cmsch.component.team.TeamService
@@ -43,7 +43,7 @@
     private val log = LoggerFactory.getLogger(javaClass)
     private val userLocks = InternalIdLocks()
 
-    fun fetchUserEntity(profile: ProfileResponse): UserEntity {
+    fun fetchUserEntity(profile: AuthschProfile): UserEntity {
         val lock = userLocks.lockForKey(profile.internalId)
         try {
             var user: UserEntity
@@ -53,7 +53,7 @@
                 log.info("Logging in with existing user ${user.fullName} as authsch user")
             } else {
                 val existingByEmail =
                     if (!profile.email.isNullOrBlank()) users.findByEmailIgnoreCase(profile.email!!) else Optional.empty()
                 if (existingByEmail.isPresent) {
                     user = existingByEmail.get()
                     log.info("Logging in with existing user ${user.fullName} (found by email) as authsch user, internalId updated from ${user.internalId} to ${profile.internalId}")
@@ -64,10 +64,11 @@
                         profile.internalId,
                         profile.neptun ?: "N/A",
                         "",
-                        (profile.surname ?: "") + " " + (profile.givenName ?: ""),
+                        profile.fullName,
                         "",
-                        profile.email ?: "",
-                        RoleType.BASIC,
+                        profile.email,
+                        role = RoleType.BASIC,
+                        secondaryEmail = profile.secondaryEmail,
                         groupName = "", group = null,
                         guild = GuildType.UNKNOWN, major = MajorType.UNKNOWN,
                         provider = AUTHSCH
@@ -115,8 +116,8 @@
                         "",
                         "${profile.familyName} ${profile.givenName}".take(254),
                         "",
-                        profile.email.take(254),
-                        RoleType.BASIC,
+                        profile.email.take(254).ifBlank { null },
+                        role = RoleType.BASIC,
                         groupName = "", group = null,
                         guild = GuildType.UNKNOWN, major = MajorType.UNKNOWN,
                         provider = GOOGLE,
@@ -164,7 +165,7 @@
             user.groupName = user.group?.name ?: ""
     }
 
-    private fun updateFieldsForAuthsch(user: UserEntity, profile: ProfileResponse) {
+    private fun updateFieldsForAuthsch(user: UserEntity, profile: AuthschProfile) {
         // Generate CMSch id if not present
         if (user.cmschId.isBlank()) {
             profileService.generateProfileIdForUser(user)
@@ -172,12 +173,24 @@
 
         // Update user profile values
         if (profile.neptun != null) {
             user.neptun = profile.neptun ?: user.neptun
         }
-        if (profile.email != null && profile.email?.isNotBlank() == true) {
+        if (profile.email != null && profile.email.isNotBlank() == true) {
             user.email = profile.email ?: user.email
         }
 
+        if (!profile.secondaryEmail.isNullOrBlank()) {
+            user.secondaryEmail = profile.secondaryEmail
+        }
+
+        // Grant admin by BME directory address
+        val authschAdminAddresses = loginComponent.authschAdminAddresses.split(Regex(", *")).filter { it.isNotBlank() }
+        if (profile.email != null && authschAdminAddresses.any { it.equals(profile.email, ignoreCase = true) }) {
+            log.info("Granting ADMIN for ${user.fullName}")
+            user.role = RoleType.ADMIN
+            user.detailsImported = true
+        }
+
         grantGuildAndGroup(user)
         grantRole(user)
 
@@ -206,7 +219,7 @@
         }
 
         // Assign groups and roles
-        if (profile.eduPersonEntitlement != null && user.role.value < RoleType.ADMIN.value) {
+        if (profile.activeMemberships.isNotEmpty() && user.role.value < RoleType.ADMIN.value) {
             assignStaffRole(profile, user)
             assignAdminRole(profile, user)
             assignOrganizerGroup(profile, user)
@@ -219,8 +232,8 @@
         }
 
         // Assign using unit-scope
-        val bmeUnitScopes = profile.bmeunitscope
-        if (unitScopeComponent.unitScopeGrantsEnabled && bmeUnitScopes != null) {
+        val bmeUnitScopes = profile.unitScopes
+        if (unitScopeComponent.unitScopeGrantsEnabled && !bmeUnitScopes.isNullOrEmpty()) {
             if (bmeUnitScopes.any { it.bme }) {
                 processUnitScopeStatus(user,
                     unitScopeComponent.bmeGrantRoleAttendee,
@@ -264,6 +277,7 @@
                     unitScopeComponent.vbkNewbieGrantGroupName)
             }
         }
+        // Assigned only when the claim is actually present
         if (bmeUnitScopes != null) {
             user.unitScopes = bmeUnitScopes.joinToString(", ")
         }
@@ -293,8 +307,8 @@
             }
         }
 
-        if (user.email.isNotBlank() && !alreadySetGroupAndGuild) {
-            groupToUserMapping.findByEmailIgnoreCase(user.email).ifPresent {
+        if (!user.email.isNullOrBlank() && !alreadySetGroupAndGuild) {
+            groupToUserMapping.findByEmailIgnoreCase(user.email!!).ifPresent {
                 user.major = it.major
                 addUserToGroup(user, it)
                 user.detailsImported = true
@@ -311,8 +325,8 @@
                 applied = true
             }
         }
-        if (!applied && user.email.isNotBlank()) {
-            roleToUserMapping.findByEmailIgnoreCase(user.email).ifPresent {
+        if (!applied && !user.email.isNullOrBlank()) {
+            roleToUserMapping.findByEmailIgnoreCase(user.email!!).ifPresent {
                 user.role = it.role
             }
         }
@@ -347,7 +361,7 @@
     }
 
     private fun assignStaffRole(
-        profile: ProfileResponse,
+        profile: AuthschProfile,
         user: UserEntity
     ) {
         val staffGroups = loginComponent.staffGroups
@@ -357,10 +371,7 @@
         if (staffGroups.isEmpty())
             return
 
-        val grantStaffRole = profile.eduPersonEntitlement
-            ?.filter { it.end == null }
-            ?.any { staffGroups.contains(it.id) }
-            ?: false
+        val grantStaffRole = profile.activeMemberships.any { staffGroups.contains(it.id) }
 
         if (grantStaffRole) {
             log.info("Granting STAFF for ${user.fullName}")
@@ -376,7 +387,7 @@
     }
 
     private fun assignAdminRole(
-        profile: ProfileResponse,
+        profile: AuthschProfile,
         user: UserEntity
     ) {
         val adminGroups = loginComponent.adminGroups
@@ -386,10 +397,7 @@
         if (adminGroups.isEmpty())
             return
 
-        val grantAdminRole = profile.eduPersonEntitlement
-            ?.filter { it.end == null }
-            ?.any { adminGroups.contains(it.id) }
-            ?: false
+        val grantAdminRole = profile.activeMemberships.any { adminGroups.contains(it.id) }
 
         if (grantAdminRole) {
             log.info("Granting ADMIN for ${user.fullName}")
@@ -398,7 +406,7 @@
     }
 
     private fun assignOrganizerGroup(
-        profile: ProfileResponse,
+        profile: AuthschProfile,
         user: UserEntity
     ) {
         val organizerGroups = loginComponent.organizerGroups
@@ -408,10 +416,7 @@
         if (organizerGroups.isEmpty())
             return
 
-        val memberOfAnyOrganizerGroups = profile.eduPersonEntitlement
-            ?.filter { it.end == null }
-            ?.any { organizerGroups.contains(it.id) }
-            ?: false
+        val memberOfAnyOrganizerGroups = profile.activeMemberships.any { organizerGroups.contains(it.id) }
 
         if (memberOfAnyOrganizerGroups && user.role.value < RoleType.STAFF.value) {
             groups.findByName(loginComponent.organizerGroupName).ifPresent {
@@ -453,8 +458,8 @@
                         "",
                         "${profile.familyName} ${profile.givenName}",
                         profile.preferredUsername,
-                        profile.email,
-                        RoleType.BASIC,
+                        profile.email.ifBlank { null },
+                        role = RoleType.BASIC,
                         groupName = "", group = null,
                         guild = GuildType.UNKNOWN, major = MajorType.UNKNOWN,
                         provider = KEYCLOAK,

backend/src/main/kotlin/hu/bme/sch/cmsch/component/login/PasswordLoginService.kt

@@ -298,6 +298,11 @@ class PasswordLoginService(
             log.error("EmailService is not available, cannot send password reset email to {}", user.email)
             return
         }
+        val recipient = user.deliveryEmail
+        if (recipient.isNullOrBlank()) {
+            log.error("User {} has no email address, cannot send password reset email", user.internalId)
+            return
+        }
         val templateName = loginComponent.passwordResetTemplate
         val template = service.getTemplateBySelector(templateName)
         if (template == null && templateName.isNotBlank()) {
@@ -307,7 +312,7 @@ class PasswordLoginService(
             "name" to user.fullName,
             "link" to "${appComponent.siteUrl}reset-password?token=$token"
         )
-        service.sendTemplatedEmail(null, template ?: getDefaultPasswordResetTemplate(), values, listOf(user.email))
+        service.sendTemplatedEmail(null, template ?: getDefaultPasswordResetTemplate(), values, listOf(recipient))
     }
 
     private fun getDefaultPasswordResetTemplate() = EmailTemplateEntity(

backend/src/main/kotlin/hu/bme/sch/cmsch/component/login/authsch/ActiveMembership.kt

@@ -0,0 +1,7 @@
+package hu.bme.sch.cmsch.component.login.authsch
+
+data class ActiveMembership(
+    val id: Long = 0,
+    val name: String = "",
+    val title: List<String> = listOf()
+)